SLIDE 1
IFIP Performance 2007 1
IFIP Performance 2007 2
Introduction
Wireless Local Area Networks (WLANs) are
commonplace in many university campuses.
Usage trends observed on a campus network
- ften transcend many other WLAN environments,
Passive Wireless-side Measurement Aniket Mahanti Carey Williamson - - PowerPoint PPT Presentation
Passive Wireless-side Measurement Aniket Mahanti Carey Williamson - - PowerPoint PPT Presentation
Remote Analysis of a Distributed WLAN using Passive Wireless-side Measurement Aniket Mahanti Carey Williamson Martin Arlitt University of Calgary IFIP Performance 2007 1 Introduction Wireless Local Area Networks (WLANs) are commonplace
SLIDE 2
SLIDE 3
IFIP Performance 2007 3
Wireless Trace Collection Methods
Wireless Laptops Wireless PDAs AP AP WLAN
Wireless Router Ethernet Sniffer DATA FRAMES Internet
Wired-side Measurement
Switch Workstation running Airopeek Wireless sniffer
Wireless-side Measurement
SLIDE 4
IFIP Performance 2007 4
Advantages of Wireless-side Measurement
Wired-side Measurement
⚫ Does not capture Control or
Management frames.
⚫ Wireless MAC header gets
replaced by an Ethernet MAC header.
⚫ Obtaining MAC/PHY
information is difficult.
⚫ Supplementary information
required for complete WLAN analysis (e.g., SNMP polling, syslog).
Wireless-side Measurement
⚫ RFGrabbers can capture all
wireless frame types.
⚫ RFGrabbers capture the complete
wireless MAC header.
⚫ Airopeek can provide MAC/PHY
information such as data rate, frame directionality, signal strength, and retransmission flags.
⚫ No supplementary information
required.
SLIDE 5
IFIP Performance 2007 5
Objectives
Demonstrate the feasibility of a practical
and commercially-available solution for remote passive wireless-side measurement in a large distributed production WLAN.
Present a comprehensive multi-layer
analysis of our WLAN datasets, from the application layer to the wireless link layer.
SLIDE 6
IFIP Performance 2007 6
Network Environment
AirUC is the wireless network available throughout the University of Calgary campus, provided by UCIT:
⚫ Uses 802.11 a/b/g standard. ⚫ Available to 28,000 students, and
5,000 faculty and staff.
⚫ Non-encrypted infrastructure network
consisting of 476 Aruba APs (2006).
⚫ APs controlled by 6 central AP
controllers.
⚫ Uses three channel spectrum for ‘b/g’
mode (channels 1,6,11).
Aruba AP 70
SLIDE 7
IFIP Performance 2007 7
Measurement Methodology
We collected WLAN traces using a specialized
trace capture program called Airopeek, which works in conjunction with network adapters to capture wireless frames.
We used off-the-shelf adapters called
RFGrabbers that can capture all 802.11 a/b/g frames at a remote location (i.e., “listen only” AP).
The RFGrabber plugs into an Ethernet LAN and
sends UDP-encapsulated copies of captured frames back to Airopeek running elsewhere on the network.
SLIDE 8
IFIP Performance 2007 8
Wireless-side Trace Collection
RFGrabbers were configured to scan channels 1, 6, and 11
every 500 ms to capture WLAN traffic in the `b/g’ mode.
RFGrabbers captured packets from 97 APs at 9 locations,
representing 20% of the WLAN.
The RFGrabber probes see 95%–99% of the traffic transiting
a nearby AP.
RFGrabber Wireless Laptops Wireless PDAs AP AP Coffee Area (8 APs) Food Court (3 APs) Main Library (4 APs) Student Centre (12 APs) Business (23 APs) Medical Library (14 APs) MedSkills (6 APs) Law (18 APs) Switch Workstations running Airopeek File Server IT Office (9 APs)
SLIDE 9
IFIP Performance 2007 9
Trace Data Overview
Trace Duration
~6 weeks (Mar 3 – Apr 14, 2006)
Number of Frames ~ 1 billion 64% Management frames 36% Data frames Number of Users 6,775 (based on MAC addresses) IP Traffic Volume (Total = 102 GB) Incoming = 58 GB Outgoing = 27 GB Local (Internal) = 17 GB
- Avg. user sessions/day
1,481 User devices 50% of user devices had built- in wireless NICs (e.g., Intel, IBM, Mac) Operating systems 60% Windows, 12% Mac OS
SLIDE 10
IFIP Performance 2007 10
Multi-layer WLAN Analysis
User view
⚫ WLAN usage ⚫ Usage regularity
Application view
⚫ Application-layer
protocols
⚫ Traffic directionality
Mobility view
⚫ APs and locations
visited
⚫ Mobility pattern
User session view
⚫ Sessions per user ⚫ Session duration ⚫ Session activity
Network view
⚫ AP load
Wireless view
⚫ Channel usage ⚫ Error rates
SLIDE 11
IFIP Performance 2007 11
User View
Daily WLAN usage Hourly WLAN usage Usage regularity
SLIDE 12
IFIP Performance 2007 12
Daily WLAN Usage
Day Mon Tue Wed Thu Fri Sat Sun Number of users 150 300 450 600 750 900 1050 1200 1350 Total users Stationary users Mobile users
More users used the WLAN during the early part of the week. On each day, about 25% of the observed users are mobile.
SLIDE 13
IFIP Performance 2007 13 Hour 4 8 12 16 20 Number of users 100 200 300 400 500 Weekday User Median Weekend User Median
Hourly WLAN Usage
Diurnal usage pattern is evident. The diurnal patterns observed were quite consistent across all of
the 9 locations studied.
The Main Library location differed slightly: activity persisted into
the late evening, because of extended hours during the final exam period.
SLIDE 14
IFIP Performance 2007 14
Usage Regularity
Number of Days 1 5 9 13 17 21 25 29 33 37 Fraction of Users 0.00 0.05 0.10 0.15 0.20 0.25 0.30 0.35 Empirical PDF Logarithmic Distribution Model PDF
Approx. 30% of users used the WLAN on only one day in trace. Only 3 users connected on all days during the trace period.
Θ=0.94
SLIDE 15
IFIP Performance 2007 15
Application View
Application-layer protocols Traffic directionality
SLIDE 16
IFIP Performance 2007 16
Application-layer Protocols
Application layer protocols Percentage of total 10 20 30 40 50 Packets Bytes
W e b P 2 P N e t w
- r
k S e r v i c e s I n t e r a c t i v e M u l t i m e d i a D a t a E x c h a n g e M a i l / N e w s O t h e r s
We used a simple port number-based approach for traffic classification.
About 46% of user traffic bytes was from Web surfing and 15% of user traffic was from known P2P applications.
About 30% of traffic was “Others” (unknown).
By applying payload-based signature classification on a separate 1-hour trace we found that a majority of the “Others” traffic was due to P2P.
SLIDE 17
IFIP Performance 2007 17
Traffic Directionality
Application layer protocols Percentage of total bytes 20 40 60 80 100 Incoming Outgoing Local
Web P2P Multimedia Interactive Mail/ News Network Services Data Exchange Others
Analysis reveals distinctive profiles for different network applications.
Web: Users surfed off-campus Web sites more than local university sites.
Data file system: Users are primarily accessing content from UofC file servers.
P2P: Traffic balance between incoming and outgoing. Low internal P2P traffic suggest that these applications do not exploit local network topology well, or that users have such diverse interests that local file sharing is rare.
SLIDE 18
IFIP Performance 2007 18
Mobility View
APs and locations visited Mobility pattern
SLIDE 19
IFIP Performance 2007 19
APs and Locations Visited
Number of APs Visited 1 5 9 13 17 21 25 29 Fraction of Users 0.00 0.05 0.10 0.15 0.20 0.25 0.30 Empirical PDF Geometric Distribution Model PDF
Number of locations visited
1 2 3 4 5 6 7
Percentage of total users
10 20 30 40 50 60
About 54% of users were seen at only a single physical location. About 30% of the users were seen at only one AP. Visit behaviour differs slightly across locations, since it is influenced
by the number of APs available.
Few users were highly mobile; nonetheless, the distribution does
have a pronounced tail.
p=0.27
SLIDE 20
IFIP Performance 2007 20
Mobility Pattern
150 300 450 600 750 900 150 300 450 600 750 900
- Med. Library
Coffee Area IT Office Student Centre Food Court Law Main Library Business
- Med. Library
MedSkills Coffee Area IT Office Student Centre Food Court Law Main Library N u m b e r
- f
U s e r s 458 844 870 802 546
The user mobility patterns observed are influenced by geographic proximity. For example, only 70 users from the two Medical Centre sites (2 kms away from the main campus) were observed using the WLAN at other campus locations.
Many users are common between the Student Centre, Food Court, Law, and Main Library, considered pairwise. These results reflect the popularity of these locations with users.
SLIDE 21
IFIP Performance 2007 21
User Session View
Sessions per user Session duration Session activity
SLIDE 22
IFIP Performance 2007 23
Session Duration
Session Duration (minutes) 100 200 300 400 500 600 Fraction of Sessions 0.00 0.02 0.04 0.06 0.08 0.10 0.12 0.14 Stationary Session PDF Mobile Session PDF
- Approx. 90% of all sessions ended within 3 hours.
About 11% of all sessions are mobile sessions.
Mobile sessions tend to last longer than stationary sessions. About 90% of all mobile sessions ended within 6 hours.
The median duration for stationary sessions was 44 minutes, while the median for mobile sessions was 2 hours.
Stationary session durations follow a Weibull distribution, while mobile session durations follow an Inverse Gaussian distribution.
α=0.93, β=66.94 λ=346.83, μ=157.39
SLIDE 23
IFIP Performance 2007 25
Network View
AP load
SLIDE 24
IFIP Performance 2007 26
AP Load
AP rank 1 11 21 31 41 51 61 71 81 91 Average daily traffic (MB) 100 200 300 400 AP rank 1 11 21 31 41 51 61 71 81 91 Average daily users 20 40 60 80 100
Load is unevenly distributed across APs. Traffic load on APs is loosely related to number of users
these APs (in the same rank order) handled.
Non-uniform AP usage seems to be an inherent
characteristic of WLANs.
SLIDE 25
IFIP Performance 2007 27
Wireless View
Channel usage CRC error rate Retransmission rate
SLIDE 26
IFIP Performance 2007 28
Channel Usage
Channel Number in IEEE 802.11 b/g 1 2 3 4 5 6 7 8 9 10 11 Fraction of Total Frames Observed 1e-7 1e-6 1e-5 1e-4 1e-3 1e-2 1e-1 1e+0 35.39% 0.15% 28.68% 0.19% 35.61%
Load is roughly balanced on channels 1, 6, 11. Frame transmissions are observed on all other channels too! Some APs in the Student Centre were configured to use
- verlapping channels (e.g., 1, 4, 8, 11). Such configurations have
been found to be practically feasible.
SLIDE 27
IFIP Performance 2007 29
CRC Error Rates
Time 3/3 8/3 14/3 23/3 28/3 3/4 8/4 13/4 Percentage of IP Packets 20 40 60 80 100 Packet size (bytes) 65 - 128 129 - 256 257 - 512 513 - 1024 >1024 Percentage of TCP Packets
10 20 30 40 50 60 70
CRC error rates were higher than expected, across all locations.
CRC errors are caused by interference from nearby traffic on the channel, poor radio link, and channel noise.
Errors are concentrated on the packet sizes that are dominant.
- Approx. 52% of TCP packets were of size 65-128 bytes and
31% of packets were bigger than 1 KB.
Probability of packet corruption increases with packet size.
SLIDE 28
IFIP Performance 2007 30
Retransmission Rates
Time 3/3 8/3 14/3 23/3 28/3 3/4 8/4 13/4 Percentage of IP Packets 20 40 60 80 100 Packet size (bytes) 65 - 128 129 - 256 257 - 512 513 - 1024 >1024 Percentage of TCP Packets 10 20 30 40 50 60
Approx. 25% of Data frames observed were retransmissions. Approx. 50% of TCP retransmitted packets were small (<128 bytes). CRC errors are only one of the reasons for packet retransmission.
Thus, there is no direct correlation between these results and the results in the previous slide.
SLIDE 29
IFIP Performance 2007 31
Summary
We presented a measurement study of a campus WLAN
environment, with the data collected using remote passive wireless-side measurement.
Our study demonstrated the feasibility and effectiveness of
remote non-intrusive wireless-side measurement in a geographically-distributed campus WLAN environment.
Analysis of our traces identified several trends consistent with
prior campus WLAN measurement studies, including diurnal usage patterns, diverse network application usage, and limited user mobility, while offering new observations on session activity, mobility patterns, and wireless channel usage in our campus WLAN.
Our analysis identified several emerging trends in application